feat: declare locked NixOS development host

Declare dev, scoped sudo/SSH, workspace ownership, Git and Neovim. Lock Nixpkgs, Home Manager and the unmodified dotfiles. Deploy user files declaratively and preserve a writable Lazy lockfile. Nix formatting and pure flake evaluation pass. Full build, empty-home deployment tests and activation of this reproducibility correction are still pending; the previous account baseline is live.
2026-09-04 23:03:22 +00:00
commit 69bc45bbf0
10 changed files with 330 additions and 0 deletions
@@ -0,0 +1,35 @@
+{
+  users.users.dev = {
+    isNormalUser = true;
+    uid = 1001;
+    description = "Development user";
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keyFiles = [ ./dev-authorized-keys ];
+  };
+
+  security.sudo.extraRules = [
+    {
+      users = [ "dev" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    backupFileExtension = "before-nix";
+    users.dev.home.stateVersion = "26.05";
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /home/dev/.config 0755 dev users -"
+    "d /home/dev/projects 0755 dev users -"
+    # Keep the working repo editable by dev. Z does not follow store symlinks.
+    "Z /etc/nixos - dev users -"
+  ];
+}